CVEs published December 18, 2025
399 CVEs were published on December 18, 2025: 35 critical, 238 high. 2 are now in CISA KEV.
- Published
- 399
- Critical
- 35
- High
- 238
- Medium
- 118
- Low
- 5
- Unrated
- 3
- Now in CISA KEV
- 2
- Fix available
- 95
Most affected products
- Kentico Xperience
- 26
- Qualcomm Snapdragon
- 11
- NI LabVIEW
- 9
- Advantech WebAccess/SCADA
- 5
- Elastic Kibana
- 5
- WODESYS WD-R608U · WODESYS WDR28 +1
- 5
- CridioStudio ListingPro
- 4
- Nozomi Networks Guardian · Nozomi Networks CMC
- 4
- Utarit Informatics Services SoliClub
- 4
- 8theme XStore
- 3
Critical 35
- CVE-2025-68398Weblate has git config file overwrite vulnerability that leads to remote code executionWeblateOrg weblate · weblate
- CVE-2025-65037Azure Container Apps Remote Code Execution VulnerabilityMicrosoft Azure Container Apps
- CVE-2025-65041Microsoft Partner Center Elevation of Privilege VulnerabilityMicrosoft Partner Center
- CVE-2025-64663Custom Question Answering Elevation of Privilege VulnerabilityMicrosoft Azure Cognitive Service for Language
- CVE-2023-53942File Thingie 2.5.7 Authenticated Arbitrary File Upload Remote Code Executionleefish File Thingie
- CVE-2023-53941EasyPHP Webserver 14.1 Remote Code ExecutionEasyPHP Webserver
- CVE-2025-14879Tenda WH450 HTTP Request onSSIDChange stack-based overflowTenda WH450
- CVE-2025-64236WordPress Tuturn plugin < 3.6 - Broken Authentication vulnerabilityAmentoTech Tuturn
- CVE-2025-14878Tenda WH450 HTTP Request wirelessRestart stack-based overflowTenda WH450
- CVE-2025-65008OS Command Injection in WODESYS WD-R608U routerWODESYS WD-R608U · WODESYS WDR28 +1
- CVE-2025-14860Use-after-free in the Disability Access APIs componentMozilla Firefox
- CVE-2025-10910Gaining remote control over Govee devicesGovee H6056
- CVE-2025-66078WordPress Hotel Booking Lite plugin <= 5.2.3 - Remote Code Execution (RCE) vulnerabilityjetmonsters Hotel Booking Lite
- CVE-2025-66074WordPress WP Webhooks plugin <= 3.3.8 - Arbitrary File Upload vulnerabilityCozmoslabs WP Webhooks
- CVE-2025-64374WordPress Motors theme <= 5.6.81 - Arbitrary File Upload vulnerabilityStylemixThemes Motors
- CVE-2025-64233WordPress Codiqa theme < 1.2.8 - PHP Object Injection vulnerabilityBoldThemes Codiqa
- CVE-2025-64231WordPress WordPress Contact Form 7 PDF, Google Sheet & Database plugin <= 3.0.0 - Arbitrary File Upload vulnerabilityRedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet…
- CVE-2025-64227WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerabilityBoldGrid Client Invoicing by Sprout Invoices
- CVE-2025-64206WordPress Jannah theme <= 7.6.0 - PHP Object Injection vulnerabilityTieLabs Jannah
- CVE-2025-64188WordPress Soledad theme <= 8.6.9 - Privilege Escalation vulnerabilityPenciDesign Soledad
- CVE-2025-60180WordPress WP Gravity Forms Salesforce plugin <= 1.5.1 - PHP Object Injection vulnerabilityCRM Perks WP Gravity Forms Salesforce
- CVE-2025-60178WordPress WP Gravity Forms HubSpot plugin <= 1.2.6 - Deserialization of untrusted data vulnerabilityCRM Perks WP Gravity Forms HubSpot
- CVE-2025-60174WordPress WP Gravity Forms Constant Contact plugin plugin <= 1.1.2 - Deserialization of untrusted data vulnerabilityCRM Perks WP Gravity Forms Constant Contact Plugin
- CVE-2025-60091WordPress WP Gravity Forms Zoho CRM and Bigin plugin <= 1.2.9 - Deserialization of untrusted data vulnerabilityCRM Perks WP Gravity Forms Zoho CRM and Bigin
- CVE-2025-60090WordPress WP Gravity Forms Insightly plugin <= 1.1.6 - Deserialization of untrusted data vulnerabilityCRM Perks WP Gravity Forms Insightly
- CVE-2025-60089WordPress WP Gravity Forms FreshDesk plugin plugin <= 1.3.5 - Deserialization of untrusted data vulnerabilityCRM Perks WP Gravity Forms FreshDesk Plugin
- CVE-2025-60062WordPress tPlayer plugin <= 1.2.1.6 - SQL Injection vulnerabilitymmetrodw tPlayer
- CVE-2025-58951WordPress Advance Seat Reservation Management for WooCommerce plugin <= 3.1 - SQL Injection vulnerabilitysmartcms Advance Seat Reservation Management for WooCommerce
- CVE-2025-54723WordPress DentiCare Theme < 1.4.3 - PHP Object Injection VulnerabilityBoldThemes DentiCare
- CVE-2025-53433WordPress EasyEat theme <= 1.9.0 - Local File Inclusion vulnerabilityAncoraThemes EasyEat
- CVE-2025-47372Buffer Copy Without Checking Size of Input in BootQualcomm Snapdragon
- CVE-2025-56157Default credentials in Dify thru 1.5.1.
- CVE-2025-63386A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint.
- CVE-2025-63388A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint.
- CVE-2025-63389A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3.github.com/ollama/ollama
High 238
- CVE-2025-64675Azure Cosmos DB Spoofing VulnerabilityMicrosoft Azure Cosmos DB
- CVE-2025-68279Weblate has an arbitrary file read via symbolic linksWeblateOrg weblate · weblate
- CVE-2025-68385Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Elastic Kibana
- CVE-2025-64677Office Out-of-Box Experience Spoofing VulnerabilityMicrosoft Office Out-of-Box Experience
- CVE-2025-64676Microsoft Purview eDiscovery Remote Code Execution VulnerabilityMicrosoft Purview
- CVE-2025-34452Streama Subtitle Download Path Traversal and SSRF Leading to Arbitrary File WriteStreama
- CVE-2025-53710Network boundaries not respected in certain Foundry namespaces.com.palantir.compute:compute-service · com.palantir.codeass…
- CVE-2025-62004BullWall Server Intrusion Protection (SIP) initialization race conditionBullWall Server Intrusion Protection
- CVE-2025-62003BullWall Server Intrusion Protection RDP MFA connection delayBullWall Server Intrusion Protection
- CVE-2025-14849Advantech WebAccess/SCADA Unrestricted Upload of File with Dangerous TypeAdvantech WebAccess/SCADA
- CVE-2025-62001BullWall Ransomware Containment hard-coded folder exclusionsBullWall Ransomware Containment
- CVE-2025-62000BullWall Ransomware Containment incomplete file inspectionBullWall Ransomware Containment
- CVE-2025-14850Advantech WebAccess/SCADA Improper Limitation of a Pathname to a Restricted DirectoryAdvantech WebAccess/SCADA
- CVE-2023-53940Codigo Markdown Editor 1.0.1 Electron Arbitrary Code Execution via Markdown FileAlfonzm Codigo Markdown Editor
- CVE-2023-53937Hubstaff 1.6.13 and 1.6.14 DLL Search Order Hijacking via wow64log LibraryHubstaff
- CVE-2023-53944EasyPHP Webserver 14.1 Path Traversal via Directory Traversal SequencesEasyPHP Webserver
- CVE-2023-53934Kentico Xperience <= 12.0.98 GetResource Handler Denial of ServiceKentico Xperience
- CVE-2021-47711Kentico Xperience <= 13.0.52 Online Marketing Macros SQL InjectionKentico Xperience
- CVE-2020-36890Kentico Xperience <= 10 Administrator Access Control BypassKentico Xperience
- CVE-2019-25229Kentico Xperience <= 12.0.29 MVC Forms Unrestricted File UploadKentico Xperience
- CVE-2025-67745Myhoard logs backup encryption key in plain textAiven-Open myhoard
- CVE-2025-14737Command Injection Vulnerability in TP-Link WA850RETP-Link Systems WA850RE
- CVE-2025-14884D-Link DIR-605 Firmware Update Service command injectionD-Link DIR-605
- CVE-2025-14896due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array.yuzutech kroki
- CVE-2025-68278tinacms vulnerable to arbitrary code executiontinacms · @tinacms/cli +1
- CVE-2025-65011Unauthorized Access to files in WODESYS WD-R608U routerWODESYS WD-R608U · WODESYS WDR28 +1
- CVE-2025-65010Missing authorizations for admin panel password change in WODESYS WD-R608U routerWODESYS WD-R608U · WODESYS WDR28 +1
- CVE-2025-65009Insecure Password Storage in WODESYS WD-R608U routerWODESYS WD-R608U · WODESYS WDR28 +1
- CVE-2025-65007Missing Authentication for Critical Function in WODESYS WD-R608U routerWODESYS WD-R608U · WODESYS WDR28 +1
- CVE-2025-64469Stack-based Buffer Overflow in LVResource::DetachResource() in NI LabVIEWNI LabVIEW
- CVE-2025-64468Use-after-Free in sentry!sentry_span_set_data() in NI LabVIEWNI LabVIEW
- CVE-2025-7358Use of Hard-coded Credentials in Utarit Informatics' SoliClubUtarit Informatics Services SoliClub
- CVE-2025-64467Out-of-Bounds Read in LVResFile::FindRsrcListEntry() in NI LabVIEWNI LabVIEW
- CVE-2025-64466Out-of-Bounds Read in lvre!ExecPostedProcRecPost() in NI LabVIEWNI LabVIEW
- CVE-2025-64465Out-of-Bounds Read in lvre!DataSizeTDR() in NI LabVIEWNI LabVIEW
- CVE-2025-64464Out-of-Bounds Read in lvre!VisaWriteFromFile() in NI LabVIEWNI LabVIEW
- CVE-2025-64463Out-of-Bounds Read in LVResource::DetachResource() in NI LabVIEWNI LabVIEW
- CVE-2025-1031IDOR in Utarit Informatics' SoliClubUtarit Informatics Services SoliClub
- CVE-2025-64462Out-of-Bounds Read in LVResFile::RGetMemFileHandle() in NI LabVIEWNI LabVIEW
- CVE-2025-1030Sensitive Data Exposure in Utarit Informatics' SoliClubUtarit Informatics Services SoliClub
- CVE-2025-64461Out of Bounds Write in mgocre_SH_25_3!RevBL() in NI LabVIEWNI LabVIEW
- CVE-2025-14861Memory safety bugs fixed in Firefox 146.0.1Mozilla Firefox
- CVE-2025-1029Hardcoded Credentials in Utarit Informatics' SoliClubUtarit Information Services SoliClub
- CVE-2025-40898Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2025-40892Stored Cross-Site Scripting (XSS) in Reports in Guardian/CMC before 25.5.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2025-14437Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log Filewpmudev Hummingbird Performance – Cache & Page Speed Optimi…
- CVE-2025-14364Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalationkraftplugins Demo Importer Plus
- CVE-2025-13641Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'smub Photo Gallery, Sliders, Proofing and Themes – NextGEN…
- CVE-2025-14874Nodemailer: nodemailer: denial of service via crafted email address headernodemailer · Red Hat Advanced Cluster Management for Kub… +3
- CVE-2025-66119WordPress Hostel plugin <= 1.1.5.9 - Cross Site Scripting (XSS) vulnerabilityBob Hostel
- CVE-2025-66118WordPress Sprout Clients plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerabilityBoldGrid Sprout Clients
- CVE-2025-66117WordPress Easy Form plugin <= 2.7.8 - Broken Access Control vulnerabilityAys Pro Easy Form
- CVE-2025-66116WordPress Ultimate Member Widgets for Elementor plugin <= 2.3 - Sensitive Data Exposure vulnerabilityUserElements Ultimate Member Widgets for Elementor
- CVE-2025-66102WordPress FV Antispam plugin <= 2.7 - Cross Site Scripting (XSS) vulnerabilityFolioVision FV Antispam
- CVE-2025-66088WordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerabilityProperty Hive PropertyHive
- CVE-2025-66070WordPress wpForo Forum plugin <= 2.4.10 - Broken Access Control vulnerabilityTomdever wpForo Forum
- CVE-2025-66054WordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerabilityThimPress LearnPress
- CVE-2025-64378WordPress ListingPro theme < 2.9.10 - Broken Access Control vulnerabilityCridioStudio ListingPro
- CVE-2025-64377WordPress ListingPro theme < 2.9.10 - Local File Inclusion vulnerabilityCridioStudio ListingPro
- CVE-2025-64376WordPress ListingPro theme < 2.9.10 - Cross Site Scripting (XSS) vulnerabilityCridioStudio ListingPro
- CVE-2025-64373WordPress Traveler theme < 3.2.6 - Local File Inclusion vulnerabilityshinetheme Traveler
- CVE-2025-64372WordPress Traveler theme < 3.2.6 - Cross Site Scripting (XSS) vulnerabilityshinetheme Traveler
- CVE-2025-64371WordPress Traveler theme < 3.2.6 - SQL Injection vulnerabilityshinetheme Traveler
- CVE-2025-64268WordPress Timetics plugin <= 1.0.44 - Broken Access Control vulnerabilityArraytics Timetics
- CVE-2025-64266WordPress Booking and Rental Manager plugin <= 2.5.4 - PHP Object Injection vulnerabilitymagepeopleteam Booking and Rental Manager
- CVE-2025-64260WordPress ANAC XML Bandi di Gara plugin <= 7.7 - Cross Site Scripting (XSS) vulnerabilityMarco Milesi ANAC XML Bandi di Gara
- CVE-2025-64258WordPress Follow My Blog Post plugin <= 2.3.9 - Sensitive Data Exposure vulnerabilitywpweb Follow My Blog Post
- CVE-2025-64230WordPress Filr plugin <= 1.2.10 - Arbitrary File Deletion vulnerabilityWP Chill Filr
- CVE-2025-64223WordPress PenNews theme < 6.7.3 - Local File Inclusion vulnerabilityPenciDesign PenNews
- CVE-2025-64222WordPress WooCommerce Recover Abandoned Cart plugin <= 24.6.0 - Arbitrary Content Deletion vulnerabilityFantasticPlugins WooCommerce Recover Abandoned Cart
- CVE-2025-64221WordPress Reservation Plugin plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilitydesignthemes Reservation Plugin
- CVE-2025-64218WordPress Passster plugin <= 4.2.19 - Sensitive Data Exposure vulnerabilityWP Chill Passster
- CVE-2025-64217WordPress Photography theme <= 7.7.2 - Cross Site Scripting (XSS) vulnerabilityThemeGoods Photography
- CVE-2025-64214WordPress MasterStudy LMS Pro plugin < 4.7.16 - Arbitrary Content Deletion vulnerabilityStylemixThemes MasterStudy LMS Pro
- CVE-2025-64213WordPress MasterStudy LMS Pro plugin < 4.7.16 - Sensitive Data Exposure vulnerabilityStylemixThemes MasterStudy LMS Pro
- CVE-2025-64209WordPress Masterstudy theme < 4.8.122 - Broken Access Control vulnerabilityStylemixThemes Masterstudy
- CVE-2025-64207WordPress Jannah theme <= 7.6.0 - Cross Site Scripting (XSS) vulnerabilityTieLabs Jannah
- CVE-2025-64205WordPress Jannah theme <= 7.6.0 - Local File Inclusion vulnerabilityTieLabs Jannah
- CVE-2025-64203WordPress Mailster plugin < 4.1.14 - Cross Site Scripting (XSS) vulnerabilityEverPress Mailster
- CVE-2025-64193WordPress XStore theme < 9.6.1 - Local File Inclusion vulnerability8theme XStore
- CVE-2025-64191WordPress XStore theme < 9.6.1 - Cross Site Scripting (XSS) vulnerability8theme XStore
- CVE-2025-64189WordPress XStore Core plugin < 5.6 - Cross Site Scripting (XSS) vulnerability8theme XStore Core
- CVE-2025-6326WordPress Inset theme <= 1.18.0 - Local File Inclusion VulnerabilityAncoraThemes Inset
- CVE-2025-6324WordPress Easy Invoice plugin <= 2.0.9 - Cross Site Scripting (XSS) vulnerabilityMatrixAddons Easy Invoice
- CVE-2025-60182WordPress Support Board plugin < 3.8.7 - Cross Site Scripting (XSS) vulnerabilitySchiocco Support Board
- CVE-2025-60086WordPress WP Voting Contest plugin <= 5.8 - Broken Access Control vulnerabilityMatt WP Voting Contest
- CVE-2025-60084WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerabilityadd-ons.org PDF for Elementor Forms + Drag And Drop Templat…
- CVE-2025-60083WordPress PDF Invoice Builder for WooCommerce plugin <= 6.5.0 - Deserialization of untrusted data vulnerabilityadd-ons.org PDF Invoice Builder for WooCommerce
- CVE-2025-60082WordPress PDF for WPForms plugin <= 6.5.0 - Deserialization of untrusted data vulnerabilityadd-ons.org PDF for WPForms
- CVE-2025-60081WordPress PDF for Contact Form 7 plugin <= 6.5.0 - Deserialization of untrusted data vulnerabilityadd-ons.org PDF for Contact Form
- CVE-2025-60080WordPress PDF for Gravity Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerabilityadd-ons.org PDF for Gravity Forms + Drag And Drop Template…
- CVE-2025-60079WordPress Parallax Section block plugin <= 1.0.9 - Broken Authentication vulnerabilitybPlugins Parallax Section block
- CVE-2025-60078WordPress Task Manager plugin <= 3.0.2 - Local File Inclusion vulnerabilityAgence web Eoxia – Montpellier Task Manager
- CVE-2025-60077WordPress YayPricing plugin <= 3.5.3 - Broken Access Control vulnerabilityYayCommerce YayPricing
- CVE-2025-60076WordPress Ray Enterprise Translation plugin <= 1.7.1 - Local File Inclusion vulnerabilityJiro Sasamoto Ray Enterprise Translation
- CVE-2025-60072WordPress Anchor smooth scroll plugin <= 1.0.2 - Local File Inclusion vulnerabilityProcessby Anchor smooth scroll
- CVE-2025-60071WordPress Riode | Multi-Purpose WooCommerce theme <= 1.6.23 - Local File Inclusion vulnerabilitydon-themes Riode
- CVE-2025-60069WordPress MinimogWP theme <= 3.9.6 - Local File Inclusion vulnerabilityThemeMove MinimogWP
- CVE-2025-60067WordPress Giardino theme <= 1.1.10 - Local File Inclusion vulnerabilityaxiomthemes Giardino
- CVE-2025-60066WordPress Katelyn theme <= 1.0.10 - Local File Inclusion vulnerabilityaxiomthemes Katelyn
- CVE-2025-60065WordPress Pinevale theme <= 1.0.14 - Local File Inclusion vulnerabilityaxiomthemes Pinevale
- CVE-2025-60064WordPress Renewal theme <= 1.2.2 - Local File Inclusion vulnerabilityaxiomthemes Renewal
- CVE-2025-60063WordPress Rosalinda theme <= 1.2.3 - Local File Inclusion vulnerabilityaxiomthemes Rosalinda
- CVE-2025-60061WordPress Kicker theme <= 2.2.0 - Local File Inclusion vulnerabilityaxiomthemes Kicker
- CVE-2025-60060WordPress Pubzinne theme <= 1.0.12 - Local File Inclusion vulnerabilityaxiomthemes Pubzinne
- CVE-2025-60059WordPress smart SEO theme <= 2.12 - Local File Inclusion vulnerabilityaxiomthemes smart SEO
- CVE-2025-60058WordPress DetailX theme <= 1.10.0 - Local File Inclusion vulnerabilityAncoraThemes DetailX
- CVE-2025-60057WordPress DJ Rainflow theme <= 1.3.13 - Local File Inclusion vulnerabilityAncoraThemes DJ Rainflow
- CVE-2025-60056WordPress Winger theme <= 1.0.16 - Local File Inclusion vulnerabilityAncoraThemes Winger
- CVE-2025-60055WordPress Fabrica theme <= 1.8.1 - Local File Inclusion vulnerabilityAncoraThemes Fabrica
- CVE-2025-60054WordPress OnLeash theme <= 1.5.2 - Local File Inclusion vulnerabilityAncoraThemes OnLeash
- CVE-2025-60053WordPress MaxCube theme <= 1.3.1 - Local File Inclusion vulnerabilityAncoraThemes MaxCube
- CVE-2025-60052WordPress W&D theme <= 1.0 - Local File Inclusion vulnerabilityAncoraThemes W&D
- CVE-2025-60051WordPress Rare Radio theme <= 1.0.15.1 - Local File Inclusion vulnerabilityAncoraThemes Rare Radio
- CVE-2025-60050WordPress Panda theme <= 1.21 - Local File Inclusion vulnerabilityaxiomthemes Panda
- CVE-2025-60049WordPress Soleil theme <= 1.17 - Local File Inclusion vulnerabilityaxiomthemes Soleil
- CVE-2025-60048WordPress Tripster theme <= 1.0.10 - Local File Inclusion vulnerabilityaxiomthemes Tripster
- CVE-2025-60047WordPress IPharm theme <= 1.2.3 - Local File Inclusion vulnerabilityaxiomthemes IPharm
- CVE-2025-60046WordPress HeartStar theme <= 1.0.14 - Local File Inclusion vulnerabilityaxiomthemes HeartStar
- CVE-2025-60045WordPress IDonatePro plugin <= 2.1.11 - Broken Access Control vulnerabilityThemeAtelier IDonatePro
- CVE-2025-60044WordPress Fribbo theme <= 1.1.0 - Local File Inclusion vulnerabilityAncoraThemes Fribbo
- CVE-2025-60043WordPress Wanderic theme <= 1.0.10 - Local File Inclusion vulnerabilityAncoraThemes Wanderic
- CVE-2025-60042WordPress Chinchilla theme <= 1.16 - Local File Inclusion vulnerabilityAncoraThemes Chinchilla
- CVE-2025-59134WordPress Sale! Immigration law, Visa services support, Migration Agent Consulting theme <= 1.5.8 - Privilege Escalation vulnerabilityJthemes Sale! Immigration law, Visa services support, Migra…
- CVE-2025-58950WordPress Lione theme <= 1.16 - Local File Inclusion vulnerabilityaxiomthemes Lione
- CVE-2025-58949WordPress Spock theme <= 1.17 - Local File Inclusion vulnerabilityaxiomthemes Spock
- CVE-2025-58948WordPress Aromatica theme <= 1.8 - Local File Inclusion vulnerabilityaxiomthemes Aromatica
- CVE-2025-58947WordPress Athos theme <= 1.9 - Local File Inclusion vulnerabilityaxiomthemes Athos
- CVE-2025-58946WordPress Vocal theme <= 1.12 - Local File Inclusion vulnerabilityaxiomthemes Vocal
- CVE-2025-58945WordPress EcoGrow theme <= 1.7 - Local File Inclusion vulnerabilityaxiomthemes EcoGrow
- CVE-2025-58944WordPress Manufactory theme <= 1.4 - Local File Inclusion vulnerabilityaxiomthemes Manufactory
- CVE-2025-58943WordPress Agricola theme <= 1.1.0 - Local File Inclusion vulnerabilityaxiomthemes Agricola
- CVE-2025-58942WordPress Dwell theme <= 1.7.0 - Local File Inclusion vulnerabilityaxiomthemes Dwell
- CVE-2025-58941WordPress Fabric theme <= 1.5.0 - Local File Inclusion vulnerabilityaxiomthemes Fabric
- CVE-2025-58940WordPress Basil theme <= 1.3.12 - Local File Inclusion vulnerabilityaxiomthemes Basil
- CVE-2025-58938WordPress IDonatePro plugin <= 2.1.9 - Broken Access Control vulnerabilityThemeAtelier IDonatePro
- CVE-2025-58937WordPress Tacticool theme <= 1.0.13 - Local File Inclusion vulnerabilityaxiomthemes Tacticool
- CVE-2025-58936WordPress Catamaran theme <= 1.15 - Local File Inclusion vulnerabilityaxiomthemes Catamaran
- CVE-2025-58935WordPress Lunna theme <= 1.15 - Local File Inclusion vulnerabilityaxiomthemes Lunna
- CVE-2025-58934WordPress The Gig theme <= 1.18.0 - Local File Inclusion vulnerabilityaxiomthemes The Gig
- CVE-2025-58933WordPress Anubis theme <= 1.25 - Local File Inclusion vulnerabilityaxiomthemes Anubis
- CVE-2025-58932WordPress Prisma theme <= 1.10 - Local File Inclusion vulnerabilityaxiomthemes Prisma
- CVE-2025-58931WordPress Palatio theme <= 1.6 - Local File Inclusion vulnerabilityaxiomthemes Palatio
- CVE-2025-58930WordPress FitFlex theme <= 1.6 - Local File Inclusion vulnerabilityaxiomthemes FitFlex
- CVE-2025-58929WordPress Pantry theme <= 1.4 - Local File Inclusion vulnerabilityaxiomthemes Pantry
- CVE-2025-58928WordPress Heart theme <= 1.8 - Local File Inclusion vulnerabilityaxiomthemes Heart
- CVE-2025-58927WordPress Stallion theme <= 1.17 - Local File Inclusion vulnerabilityaxiomthemes Stallion
- CVE-2025-58926WordPress Cerebrum theme <= 1.12 - Local File Inclusion vulnerabilityaxiomthemes Cerebrum
- CVE-2025-58925WordPress Neptunus theme <= 1.0.11 - Local File Inclusion vulnerabilityaxiomthemes Neptunus
- CVE-2025-58923WordPress Critique theme <= 1.17 - Local File Inclusion vulnerabilityaxiomthemes Critique
- CVE-2025-58901WordPress Takeout theme <= 1.3.0 - Local File Inclusion vulnerabilityAncoraThemes Takeout
- CVE-2025-58900WordPress UniTravel theme <= 1.4.2 - Local File Inclusion vulnerabilityAncoraThemes UniTravel
- CVE-2025-58899WordPress Frame theme <= 2.4.0 - Local File Inclusion vulnerabilityAncoraThemes Frame
- CVE-2025-58898WordPress HealthHub theme <= 1.3.0 - Local File Inclusion vulnerabilityAncoraThemes HealthHub
- CVE-2025-58896WordPress Otaku theme <= 1.8.0 - Local File Inclusion vulnerabilityAncoraThemes Otaku
- CVE-2025-58895WordPress Integro theme <= 1.8.0 - Local File Inclusion vulnerabilityAncoraThemes Integro
- CVE-2025-58894WordPress Good Mood theme <= 1.16 - Local File Inclusion vulnerabilityaxiomthemes Good Mood
- CVE-2025-58893WordPress Alright theme <= 1.6.1 - Local File Inclusion vulnerabilityaxiomthemes Alright
- CVE-2025-58892WordPress Tourimo theme <= 1.2.3 - Local File Inclusion vulnerabilityAncoraThemes Tourimo
- CVE-2025-58891WordPress Sanger theme <= 1.24.0 - Local File Inclusion vulnerabilityAncoraThemes Sanger
- CVE-2025-58890WordPress Playful theme <= 1.19.0 - Local File Inclusion vulnerabilityAncoraThemes Playful
- CVE-2025-58889WordPress Towny theme <= 1.16 - Local File Inclusion vulnerabilityaxiomthemes Towny
- CVE-2025-58888WordPress The Flash theme <= 1.15 - Local File Inclusion vulnerabilityAncoraThemes The Flash
- CVE-2025-58885WordPress Pathfinder theme <= 1.16 - Local File Inclusion vulnerabilityAncoraThemes Pathfinder
- CVE-2025-58879WordPress Festy theme <= 1.13.0 - Local File Inclusion vulnerabilityAncoraThemes Festy
- CVE-2025-58877WordPress Javo Core plugin <= 3.0.0.529 - Arbitrary Content Deletion vulnerabilityjavothemes Javo Core
- CVE-2025-58803WordPress Algenix theme <= 1.0 - Local File Inclusion vulnerabilityaxiomthemes Algenix
- CVE-2025-58710WordPress Hotel Listing plugin <= 1.4.0 - Privilege Escalation vulnerabilitye-plugins Hotel Listing
- CVE-2025-58709WordPress Legacy theme <= 1.9 - Local File Inclusion vulnerabilityaxiomthemes Legacy
- CVE-2025-58708WordPress 777 theme <= 1.3 - Local File Inclusion vulnerabilityaxiomthemes
- CVE-2025-58706WordPress Woo Hoo theme <= 1.25 - Local File Inclusion vulnerabilityaxiomthemes Woo Hoo
- CVE-2025-58225WordPress Paragon theme <= 1.1 - Local File Inclusion vulnerabilityaxiomthemes Paragon
- CVE-2025-57897WordPress Logtik theme <= 2.3 - Cross Site Scripting (XSS) vulnerabilityvenusweb Logtik
- CVE-2025-55707WordPress PostX Plugin <= 4.1.35 - Privilege Escalation VulnerabilityWPXPO PostX
- CVE-2025-54751WordPress PostX plugin <= 4.1.36 - Broken Access Control vulnerabilityWPXPO PostX
- CVE-2025-53453WordPress Hygia theme <= 1.16 - Local File Inclusion vulnerabilityaxiomthemes Hygia
- CVE-2025-53449WordPress Convex theme <= 1.11 - Local File Inclusion vulnerabilityaxiomthemes Convex
- CVE-2025-53448WordPress Rally theme <= 1.1 - Local File Inclusion vulnerabilityaxiomthemes Rally
- CVE-2025-53447WordPress Assembly theme <= 1.1 - Local File Inclusion vulnerabilityaxiomthemes Assembly
- CVE-2025-53446WordPress Beautique theme <= 1.5 - Local File Inclusion vulnerabilityaxiomthemes Beautique
- CVE-2025-53445WordPress Catwalk theme <= 1.4 - Local File Inclusion vulnerabilityaxiomthemes Catwalk
- CVE-2025-53443WordPress Smash theme <= 1.7 - Local File Inclusion vulnerabilityaxiomthemes Smash
- CVE-2025-53442WordPress Rentic theme <= 1.1 - Local File Inclusion vulnerabilityaxiomthemes Rentic
- CVE-2025-53441WordPress Greeny theme <= 2.6 - Local File Inclusion vulnerabilityaxiomthemes Greeny
- CVE-2025-53439WordPress Harper theme <= 1.13 - Local File Inclusion vulnerabilityaxiomthemes Harper
- CVE-2025-53438WordPress FitLine theme <= 1.6 - Local File Inclusion vulnerabilityaxiomthemes FitLine
- CVE-2025-53437WordPress Greenorganic theme <= 2.45 - Local File Inclusion vulnerabilityApusTheme Greenorganic
- CVE-2025-53436WordPress Monki theme <= 2.0.5 - Local File Inclusion vulnerabilityBZOTheme Monki
- CVE-2025-53435WordPress Plan My Day theme <= 1.1.13 - Local File Inclusion vulnerabilityaxiomthemes Plan My Day
- CVE-2025-53434WordPress ChildHope theme <= 1.1.8 - Local File Inclusion vulnerabilityAncoraThemes ChildHope
- CVE-2025-53432WordPress Echo theme <= 1.15.0 - Local File Inclusion vulnerabilityAncoraThemes Echo
- CVE-2025-53431WordPress Emberlyn theme <= 1.3.1 - Local File Inclusion vulnerabilityAncoraThemes Emberlyn
- CVE-2025-53430WordPress Etta theme <= 1.14.0 - Local File Inclusion vulnerabilityAncoraThemes Etta
- CVE-2025-53429WordPress Exit Game theme <= 1.4.3 - Local File Inclusion vulnerabilityAncoraThemes Exit Game
- CVE-2025-52768WordPress Faith & Hope theme <= 2.13.0 - Local File Inclusion vulnerabilityAncoraThemes Faith & Hope
- CVE-2025-52745WordPress Farm Agrico theme <= 1.3.11 - Local File Inclusion vulnerabilityAncoraThemes Farm Agrico
- CVE-2025-49943WordPress Femme theme <= 1.3.11 - Local File Inclusion vulnerabilityAncoraThemes Femme
- CVE-2025-49942WordPress Gardis theme <= 1.2.13 - Local File Inclusion vulnerabilityAncoraThemes Gardis
- CVE-2025-49941WordPress GlamChic theme <= 1.0.11 - Local File Inclusion vulnerabilityAncoraThemes GlamChic
- CVE-2025-49379WordPress Custom Fields Account Registration For Woocommerce plugin <= 1.2 - Privilege Escalation vulnerabilitysilverplugins217 Custom Fields Account Registration For Woo…
- CVE-2025-49371WordPress Strux theme <= 1.9 - Local File Inclusion vulnerabilityAncoraThemes Strux
- CVE-2025-49370WordPress Lymcoin theme <= 1.3.12 - Local File Inclusion vulnerabilityAncoraThemes Lymcoin
- CVE-2025-49369WordPress Lettuce theme <= 1.1.7 - Local File Inclusion vulnerabilityAncoraThemes Lettuce
- CVE-2025-49368WordPress Palladio theme <= 1.1.10 - Local File Inclusion vulnerabilityAncoraThemes Palladio
- CVE-2025-49367WordPress Monyxi theme <= 1.1.8 - Local File Inclusion vulnerabilityAncoraThemes Monyxi
- CVE-2025-49366WordPress Hanani theme <= 1.2.11 - Local File Inclusion vulnerabilityAncoraThemes Hanani
- CVE-2025-49365WordPress Jack Well theme <= 1.0.14 - Local File Inclusion vulnerabilityAncoraThemes Jack Well
- CVE-2025-49364WordPress Ludos Paradise theme <= 2.1.3 - Local File Inclusion vulnerabilityAncoraThemes Ludos Paradise
- CVE-2025-49363WordPress Kings & Queens theme <= 1.1.16 - Local File Inclusion vulnerabilityAncoraThemes Kings & Queens
- CVE-2025-49362WordPress Gracioza theme <= 1.0.15 - Local File Inclusion vulnerabilityAncoraThemes Gracioza
- CVE-2025-49361WordPress Mamita theme <= 1.0.9 - Local File Inclusion vulnerabilityAncoraThemes Mamita
- CVE-2025-49360WordPress Militarology theme <= 1.0.15 - Local File Inclusion vulnerabilityAncoraThemes Militarology
- CVE-2025-49359WordPress ShieldGroup theme <= 2.13 - Local File Inclusion vulnerabilityAncoraThemes ShieldGroup
- CVE-2025-14314WordPress PopupKit plugin <= 2.1.5 - SQL Injection vulnerabilityRoxnor PopupKit
- CVE-2025-68459RG - AP180, Indoor Wall Plate Wireless AP AP180 series provided by Ruijie Networks Co., Ltd.Ruijie Networks Co. AP180-PE V3.xx · Ruijie Networks Co.… +7
- CVE-2025-47387Untrusted Pointer Dereference in CameraQualcomm Snapdragon
- CVE-2025-47382Incorrect Authorization in BootQualcomm Snapdragon
- CVE-2025-47350Use After Free in DSP ServiceQualcomm Snapdragon
- CVE-2025-47323Integer Overflow or Wraparound in AudioQualcomm Snapdragon
- CVE-2025-47322Use After Free in Automotive Linux OSQualcomm Snapdragon
- CVE-2025-47321Buffer Copy Without Checking Size of Input in Core ServicesQualcomm Snapdragon
- CVE-2025-47320Out-of-bounds Write in AudioQualcomm Snapdragon
- CVE-2025-27063Use After Free in VideoQualcomm Snapdragon
- CVE-2025-68461Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG dRoundcube Webmail
- CVE-2025-68460Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.Roundcube Webmail
- CVE-2025-63387Dify v1.9.1 is vulnerable to Insecure Permissions.dify-client
- CVE-2025-63757Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0.
- CVE-2025-63950An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through commit b1c58a7d1dc664b
- CVE-2025-63951An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project through commit 4b2334f0a
- CVE-2025-65559An issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session Establishment Request (type=50), the UPF crashes with a
- CVE-2025-65561An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified imp
- CVE-2025-65562The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests.
- CVE-2025-65563A denial-of-service vulnerability exists in the omec-project UPF (component upf-epc/pfcpiface) up to at least version upf-epc-pfcpiface:2.1.
- CVE-2025-65564A denial-of-service vulnerability exists in the omec-upf (upf-epc-pfcpiface) in version upf-epc-pfcpiface:2.1.3-dev.
- CVE-2025-65565A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev.
- CVE-2025-65566A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev.
- CVE-2025-65567A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev.
- CVE-2025-65568A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev.
Medium, low and unrated 126
- CVE-2025-14898CodeAstro Real Estate Management System Administrator Endpoint userbuilderdelete.php sql injectionCodeAstro Real Estate Management System
- CVE-2025-14897CodeAstro Real Estate Management System Administrator Endpoint useragentdelete.php sql injectionCodeAstro Real Estate Management System
- CVE-2025-68422Kibana Improper AuthorizationElastic Kibana
- CVE-2025-68386Kibana Improper AuthorizationElastic Kibana
- CVE-2025-68390Elasticsearch Allocation of Resources Without Limits or ThrottlingElasticsearch · org.elasticsearch.plugin:x-pack-core
- CVE-2025-68389Kibana Allocation of Resources Without Limits or ThrottlingElastic Kibana
- CVE-2025-68387Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Elastic Kibana
- CVE-2025-68384Elasticsearch Allocation of Resources Without Limits or ThrottlingElasticsearch · org.elasticsearch.plugin:x-pack-security
- CVE-2025-65046Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge for Android
- CVE-2025-68383Filebeat Improper Validation of Specified Index, Position, or Offset in InputElastic Filebeat · github.com/elastic/beats +1
- CVE-2025-13427Authentication Bypass in Dialogflow CX MessengerGoogle Cloud Dialogflow CX Messenger
- CVE-2025-68382Packetbeat Out-of-bounds ReadElastic Packetbeat
- CVE-2025-68381Packetbeat Improper Bounds CheckElastic Packetbeat
- CVE-2025-68388Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEElastic Packetbeat · github.com/elastic/beats +1
- CVE-2025-34451rofl0r/proxychains-ng <= 4.17 Stack-based Buffer Overflowrofl0r proxychains-ng
- CVE-2025-34450merbanan/rtl_433 <= 25.02 Stack-based Buffer Overflowmerbanan rtl_433
- CVE-2025-34449Genymobile/scrcpy <= 3.3.3 Global Buffer OverflowGenymobile scrcpy
- CVE-2025-68161Apache Log4j Core: Missing TLS hostname verification in Socket appenderApache Software Foundation Apache Log4j Core · org.apache.l…
- CVE-2025-67653Advantech WebAccess/SCADA Path TraversalAdvantech WebAccess/SCADA
- CVE-2025-46268Advantech WebAccess/SCADA SQL InjectionAdvantech WebAccess/SCADA
- CVE-2025-14848Advantech WebAccess/SCADA Absolute Path TraversalAdvantech WebAccess/SCADA
- CVE-2025-62002BullWall Ransomware Containment file count detection bypassBullWall Ransomware Containment
- CVE-2025-59529Avahi: simple protocol server ignores accepts unlimited connections and logs failures without limitavahi
- CVE-2025-13911Inductive Automation Ignition Execution with Unnecessary PrivilegesInductive Automation Ignition
- CVE-2025-14889Campcodes Advanced Voting Management System Password voters_edit.php improper authorizationCampcodes Advanced Voting Management System
- CVE-2024-58323Kentico Xperience <= 13.0.158 Checkbox Form Component Stored XSSKentico Xperience
- CVE-2024-58322Kentico Xperience <= 13.0.158 Shipping Options Stored XSSKentico Xperience
- CVE-2024-58321Kentico Xperience <= 13.0.159 Form Validation Stored XSSKentico Xperience
- CVE-2024-58320Kentico Xperience <= 13.0.159 Authentication Information DisclosureKentico Xperience
- CVE-2024-58319Kentico Xperience <= 13.0.160 Pages Dashboard Widget Reflected XSSKentico Xperience
- CVE-2024-58318Kentico Xperience <= 13.0.162 Rich Text Editor Stored XSSKentico Xperience
- CVE-2024-58317Kentico Xperience <= 13.0.164 Cookie Security ConfigurationKentico Xperience
- CVE-2023-53943GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password EndpointGlpi-Project GLPI
- CVE-2023-53939TinyWebGallery v2.5 Stored Cross-Site Scripting via Folder Name ParameterTinyWebGallery
- CVE-2023-53938RockMongo 1.1.7 Stored Cross-Site Scripting Vulnerability via Multiple Parametersiwind RockMongo
- CVE-2023-53936Cameleon CMS 2.7.4 Authenticated Persistent Cross-Site Scripting via Post Creationtuzitio Cameleon CMS
- CVE-2023-53935WBiz Desk 1.2 SQL Injection Vulnerability via ticket.php ParameterCodester WBiz Desk
- CVE-2023-53738Kentico Xperience <= 13.0.109 Page Preview Reflected XSSKentico Xperience
- CVE-2023-53737Kentico Xperience <= 13.0.101 Localization Application Stored XSSKentico Xperience
- CVE-2023-53736Kentico Xperience <= 13.0.120 Administration Interface Reflected XSSKentico Xperience
- CVE-2022-50686Kentico Xperience <= 12.0 Portal Engine Form Control Information DisclosureKentico Xperience
- CVE-2022-50685Kentico Xperience <= 13.0.56 File Upload Stored XSSKentico Xperience
- CVE-2022-50684Kentico Xperience <= 13.0.71 Form Emails HTML InjectionKentico Xperience
- CVE-2022-50683Kentico Xperience <= 13.0.74 Form Configuration Stored XSSKentico Xperience
- CVE-2022-50682Kentico Xperience <= 13.0.79 Routing Engine CRLF InjectionKentico Xperience
- CVE-2022-50681Kentico Xperience <= 13.0.88 Rich Text Editor Reflected XSSKentico Xperience
- CVE-2022-50680Kentico Xperience <= 13.0.92 Email Marketing Stored XSSKentico Xperience
- CVE-2021-47712Kentico Xperience <= 12.0.102 URL Hashing Cryptography VulnerabilityKentico Xperience
- CVE-2020-36891Kentico Xperience <= 12.0.49 File Upload Stored XSSKentico Xperience
- CVE-2020-36889Kentico Xperience <= 12.0.90 Administration Interface Stored XSSKentico Xperience
- CVE-2019-25230Kentico Xperience <= 12.0.0 User Widget Information DisclosureKentico Xperience
- CVE-2019-25228Kentico Xperience <= 12.0.47 Virtual Context Information DisclosureKentico Xperience
- CVE-2025-64400Insufficient permission checks when pre-enrolling users Summarycom.palantir.controlpanel:control-panel
- CVE-2025-14885SourceCodester Client Database Management System Leads Generation user_leads.php unrestricted uploadSourceCodester Client Database Management System
- CVE-2025-59949FreshRSS has Logout CSRF that Leads to DoS via <track src>FreshRSS
- CVE-2025-14739Uninitialized Pointer Vulnerability in TP-Link WR940N and WR941NDTP-Link Systems WR940N and WR941ND
- CVE-2025-14738Configuration Disclosure Vulnerability in TP-Link WA850RETP-Link Systems WA850RE
- CVE-2025-62960WordPress Construction Light theme <= 1.6.7 - Broken Access Control vulnerabilitysparklewpthemes Construction Light
- CVE-2025-62961WordPress Sparkle FSE theme <= 1.0.9 - Broken Access Control vulnerabilitysparklewpthemes Sparkle FSE
- CVE-2025-62998WordPress WP AI CoPilot plugin <= 1.2.7 - Sensitive Data Exposure vulnerabilityWP Messiah WP AI CoPilot
- CVE-2025-63002WordPress Sermon Manager plugin <= 2.30.0 - Broken Access Control vulnerabilitywpforchurch Sermon Manager
- CVE-2025-63043WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Insecure Direct Object References (IDOR) vulnerabilityPickPlugins Post Grid and Gutenberg Blocks
- CVE-2025-64235WordPress Tuturn plugin < 3.6 - Arbitrary File Download vulnerabilityAmentoTech Tuturn
- CVE-2025-64282WordPress Radius Blocks plugin <= 2.2.1 - Insecure Direct Object References (IDOR) vulnerabilityRadiusTheme Radius Blocks
- CVE-2025-64355WordPress JetElements For Elementor plugin <= 2.7.12 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetElements For Elementor
- CVE-2025-66058WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.17 - Broken Access Control vulnerabilityPickPlugins Post Grid and Gutenberg Blocks
- CVE-2025-14877Campcodes Supplier Management System add_retailer.php sql injectionCampcodes Supplier Management System
- CVE-2025-14823Certificate Signing Extension Returns Encrypted ValuesConnectWise ScreenConnect
- CVE-2025-68469ImageMagick vulnerable to heap-buffer-overflowImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2025-64724Arduino IDE for macOS has Insecure File Permissionsarduino-ide
- CVE-2025-64723Arduino IDE for macOS has TCC Bypass via Dynamic Library Injectionarduino-ide
- CVE-2025-68325net/sched: sch_cake: Fix incorrect qlen reduction in cake_dropLinux
- CVE-2025-68324scsi: imm: Fix use-after-free bug caused by unfinished delayed workLinux
- CVE-2025-68323usb: typec: ucsi: fix use-after-free caused by uec->workLinux
- CVE-2025-7047Missing Authorization in Utarit Informatics' SoliClubUtarit Informatics Services SoliClub
- CVE-2025-14744Filename spoofing via Unicode Right-to-Left Override in Firefox for iOSMozilla Firefox for iOS
- CVE-2025-9787Stored XSSZohocorp ManageEngine Applications Manager
- CVE-2025-65000Exposure of SSH Private Keys in Remote Alert Handlers (Linux) RuleCheckmk
- CVE-2025-40893HTML injection in Asset List in Guardian/CMC before 25.5.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2025-40891HTML injection in in Time Machine functionality in Guardian/CMC before 25.5.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2025-13110HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.3 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_subscr'realmag777 HUSKY – Products Filter Professional for WooComm…
- CVE-2025-14618Sweet Energy Efficiency <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Graph Deletionwpdirectorykit Sweet Energy Efficiency
- CVE-2025-14277Prime Slider – Addons for Elementor <= 4.0.9 - Authenticated (Subscriber+) Server-Side Request Forgerybdthemes Prime Slider – Addons for Elementor
- CVE-2025-40602A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).SonicWall SMA1000
- CVE-2025-13730OpenID Connect Generic Client <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodedaggerhart OpenID Connect Generic Client
- CVE-2025-64997Insufficient permission validation when showing agent informationCheckmk
- CVE-2025-14318Improper access validation in M-Files ServerM-Files Server
- CVE-2025-67546WordPress WP ERP plugin <= 1.16.6 - Sensitive Data Exposure vulnerabilityweDevs WP ERP
- CVE-2025-66104WordPress Offload, AI & Optimize with Cloudflare Images plugin <= 1.9.5 - Broken Access Control vulnerabilityAnton Vanyukov Offload, AI & Optimize with Cloudflare Images
- CVE-2025-66100WordPress RestroPress plugin <= 3.2.3.5 - Broken Access Control vulnerabilityMagnigenie RestroPress
- CVE-2025-66068WordPress InstaWP Connect plugin <= 0.1.1.9 - Broken Access Control vulnerabilityInstaWP Connect
- CVE-2025-64375WordPress WP Social Ninja plugin <= 3.20.1 - Broken Access Control vulnerabilityMahmudul Hasan Arif WP Social Ninja
- CVE-2025-64295WordPress All In One SEO Pack plugin <= 4.8.6.1 - Sensitive Data Exposure vulnerabilitySyed Balkhi All In One SEO Pack
- CVE-2025-64273WordPress Email marketing for WordPress by GetResponse Official plugin <= 1.5.3 - Broken Access Control vulnerabilityEmail marketing for WordPress by GetResponse Official
- CVE-2025-64272WordPress Email marketing for WordPress by GetResponse Official plugin <= 1.5.3 - Sensitive Data Exposure vulnerabilityEmail marketing for WordPress by GetResponse Official
- CVE-2025-64270WordPress Masteriyo - LMS plugin <= 2.0.3 - Sensitive Data Exposure vulnerabilityMasteriyo - LMS
- CVE-2025-64225WordPress Stockie Extra plugin <= 1.2.11 - Content Injection vulnerabilitycolabrio Stockie Extra
- CVE-2025-64192WordPress XStore theme < 9.6 - Broken Access Control vulnerability8theme XStore
- CVE-2025-63039WordPress ListingPro theme <= 2.9.9 - Broken Access Control vulnerabilityCridioStudio ListingPro
- CVE-2025-60088WordPress WebinarIgnition plugin <= 4.06.04 - Broken Access Control vulnerabilitySaleswonder Team: Tobias WebinarIgnition
- CVE-2025-60070WordPress Molla - Multipurpose Responsive Shopify theme <= 1.5.13 - Arbitrary Code Execution vulnerabilityThe4 Molla
- CVE-2025-60068WordPress Javo Core plugin <= 3.0.0.266 - Arbitrary Code Execution vulnerabilityjavothemes Javo Core
- CVE-2025-54748WordPress MapSVG Plugin < 8.6.12 - Arbitrary File Download VulnerabilityRomanCode MapSVG
- CVE-2025-54745WordPress miniOrange's Google Authenticator Plugin <= 6.1.1 - Broken Access Control VulnerabilityminiOrange's Google Authenticator
- CVE-2025-54743WordPress Download After Email Plugin 2.1.5-2.1.6 - Other Vulnerability Type Vulnerabilitymkscripts Download After Email
- CVE-2025-54741WordPress Super Blank Plugin <= 1.2.0 - Arbitrary Content Deletion VulnerabilityTyler Moore Super Blank
- CVE-2025-49919WordPress eRoom plugin <= 1.5.6 - Sensitive Data Exposure vulnerabilityDigitalME eRoom
- CVE-2025-49918WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.2 - Sensitive Data Exposure vulnerabilitye4jvikwp VikBooking Hotel Booking Engine & PMS
- CVE-2025-49914WordPress Restaurant Menu by MotoPress plugin <= 2.4.7 - Sensitive Data Exposure vulnerabilityjetmonsters Restaurant Menu by MotoPress
- CVE-2025-49902WordPress Login Page Customizer – Customizer Login Page, Admin Page, Custom Design plugin <= 2.1.1 - Broken Access Control vulnerabilityA WP Life Login Page Customizer – Customizer Login Page, Ad…
- CVE-2025-49041WordPress Get Cash plugin <= 3.2.3 - Broken Access Control vulnerabilityThe African Boss Get Cash
- CVE-2025-10019WordPress Contact Form Email plugin <= 1.3.60 - Insecure Direct Object References (IDOR) vulnerabilitycodepeople Contact Form Email
- CVE-2025-13498Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosurecodename065 Download Manager
- CVE-2025-12976Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcodenetweblogic Events Manager – Calendar, Bookings, Tickets, a…
- CVE-2025-68463Bio.Entrez in Biopython through 186 allows doctype XXE.Biopython
- CVE-2025-47325Untrusted Pointer Dereference in TZ FirmwareQualcomm Snapdragon
- CVE-2025-47319Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOSQualcomm Snapdragon
- CVE-2025-68462Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.Debian FreedomBox
- CVE-2025-12885Embed Any Document <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scriptingawsmin Embed Any Document – Embed PDF, Word, PowerPoint and…
- CVE-2025-14856y_project RuoYi getnames code injectiony_project RuoYi
- CVE-2025-14841OFFIS DCMTK dcmqrscp dcmqrdbi.cc startMoveRequest null pointer dereferenceOFFIS DCMTK
- CVE-2025-63390An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint.
- CVE-2025-63947A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file.
- CVE-2025-63948A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file.
- CVE-2025-63949A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remote attacker to execut
- CVE-2025-67163A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML